In some security models, one or more roots-of-trust are used to support a trusted computing platform. For example, in some of the security models presented by the Trusted Computing Group, three roots-of-trust are used: a root-of-trust for storage (RTS), a root-of-trust for reporting (RTR) and a root-of-trust for measurement (RTM). The locations of these roots-of-trust within a computing platform may vary. Some computing platforms, for example, include the RTR and the RTS in a Trusted Platform Module (TPM), a physical component (typically a chip) that acts to detect tampering with the hardware and software configuration. The RTM in such a platform, however, may be provided by platform firmware. In particular, when such a computing platform begins to boot, a core RTM (cRTM), implemented in an immutable form such as ROM in the pre-BIOS of the device, measures the next set of code to be executed, cryptographically hashes this measurement, and stores the hash digest value in the TPM. Control is passed to this next set of code, which then measures the subsequent set of code and stores a hash digest value of the measurement in the TPM. This chain of measurement continues until boot is complete and the OS is loaded. Changes in the configuration of the boot stages (due to, e.g., malware or tampering) may be detected by comparing the stored hash values in the TPM against their previous values. The cRTM, as the initial measuring component, is not measured before execution and is assumed to be correct by design.
In a virtualized environment, a guest virtual machine (VM) runs in a software-based environment provided by a virtual machine manager (VMM, also called a hypervisor). The environment may include VMs that provide virtualized versions of a number of physical components of traditional computing platforms, such as drivers for hardware, and VMs that provide support functions for VM maintenance, such as VMs that can manipulate the memory of a guest VM. Some previous work has applied the TPM concept to virtualized systems and developed a virtual machine TPM (vTPM). In some such systems, each guest VM may be associated with its own vTPM, which serves as the RTS and RTR for the chain of measurements of the associated guest VM. An RTM, which may measure VMs and other software components that support the vTPM, may be implemented as VM on the same hypervisor. However, such an RTM is just as susceptible as the vTPM to tampering, and is entirely reliant on the trustworthiness of the hypervisor. This may result in an overly large trusted computing base, and as a result, vulnerability to security breaches in the hypervisor or other components.